Auftragsverarbeitungsvertrag (AVV/DPA) – English
Zuletzt aktualisiert:
This agreement is part of the QRtimetrack Terms and Conditions and applies automatically to every customer (the employer), under Article 28 of Regulation (EU) 2016/679 (GDPR). If you need a signed copy, write to contact@qrtimetrack.com.
1. Parties and roles
The customer (the employer using QRtimetrack) is the controller of its employees' data. NINE UNIT GROUP S.R.L., CUI 54549440, J2026027060009, București, Sector 1, Intrarea Gheorghe Simionescu nr. 19, ap. B26 is the processor and processes this data only to provide the service and only on the customer's documented instructions (the account settings and this agreement).
2. Subject matter and duration
Working-time records: clock-ins (in, out, breaks), location at the moment of clocking in, selfies (if the customer requires them), presence checks, leave requests, tasks, reports and exports. Processing lasts as long as the customer's account is active, plus the deletion period below.
3. Data subjects and data categories
The customer's employees and contractors, and dashboard users (managers, admins). Data: name, phone/e-mail (optional), job title, hours worked, GPS location at clock-in, IP address for computer clock-ins, selfie, computer activity (active/idle only, if enabled), leave requests. We process no biometric data: Face ID / fingerprint are verified on the employee's phone. We do not perform facial recognition: selfies are only photos attached to the clock-in, are not technically processed to identify anyone and are deleted after 30 days.
4. Our obligations
We process data only to provide the service; ensure confidentiality of everyone with access; apply appropriate technical and organisational measures; help the customer answer data-subject requests (access, rectification, erasure, export); notify the customer without undue delay, at most 48 hours after becoming aware, of any personal data breach; and make available the information needed to demonstrate compliance; inform the customer immediately if an instruction infringes data protection law; assist the customer with data protection impact assessments (DPIA), prior consultation and its obligations under Art. 32–36 GDPR. A breach notification describes its nature, the categories and approximate number of people and records concerned, the likely consequences and the measures taken (Art. 33(3) GDPR). We keep a record of processing activities as a processor (Art. 30(2) GDPR).
5. Security measures
Encrypted connections (HTTPS/TLS); database and files hosted in the European Union (Frankfurt); per-company separation enforced by database rules; passwords stored only as hashes; managers limited to their locations; audit log of corrections (who, when, why); selfies deleted automatically after 30 days; daily backup kept for 14 days.
6. Sub-processors
The customer authorises the following sub-processors: Supabase Inc. (database and files, EU region – Frankfurt, Germany); OVH SAS (dedicated application server, Gravelines, France – EU); Resend Inc. (service e-mails, USA; standard contractual clauses); Stripe Payments Europe Ltd. (payments, Ireland; customer billing data only); the phones' push notification services (Apple, Google, Mozilla), which only receive the notification text. Google Analytics is used on the website only, only with the visitor's consent, and receives no employee data. We impose on each sub-processor, by contract, the same data protection obligations as in this agreement and remain liable to the customer for them. We give at least 30 days' notice before adding or changing a sub-processor; the customer may object and close the account at no cost.
7. Transfers outside the EU
The database and files (including selfies) are stored in the EU, in Frankfurt. The application server is in the EU (OVH, Gravelines, France). E-mail delivery (Resend) is in the USA: contact data passes through it, under the European Commission's standard contractual clauses (Decision 2021/914), with encryption in transit and a transfer impact assessment that we keep and share with the customer on request.
8. Customer obligations
The customer determines the legal basis (usually the legal obligation to record working time and legitimate interest), informs employees (the app shows a notice the employee acknowledges), configures optional features (selfie, presence checks, computer activity) proportionately and, where required, consults employee representatives.
9. Deletion and return of data
The customer can export data at any time (Excel, CSV, API). When the account is closed, the customer chooses whether the data is returned (full export) or deleted; deletion happens within 30 days. Where the law requires working-time records to be kept (e.g. 4 years in Spain), the customer must export and archive the data before closing. Data is deleted, except data we must keep by law (e.g. invoices). Backup copies disappear within a further 14 days.
10. Audits
On the customer's written request we provide information on our security measures. An on-site audit may take place once a year with 30 days' notice, at the customer's expense, without affecting other customers' confidentiality.
11. Final provisions
If this agreement conflicts with the Terms and Conditions, this agreement prevails on data protection matters. Romanian law applies.